Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Daniel_Stuckey writes "Tor has been in the spotlight lately as a way to keep prying eyes away from your online activities. However, to your average internet user, the covert network of relays and whatchamacallits can come off as too complex and intimidating to bother with — even as people are increasingly concerned with their online privacy in light of the NSA scandal. So goes the thinking behind Safeplug, a new hardware adapter that basically puts Tor in a box. It takes 60 seconds and 50 bucks to plug the privacy box into your router, and you're good to go, the company claims. Like anonymous browsing for dummies. The adapter comes from hardware company Pogoplug, which announced its new product yesterday and hopes it will bring Tor to the mass market by offering more consumer-friendly access. 'We want to just take what is currently available today to a more technical crowd and democratize it, making it easier to use for an average user,' CEO Dan Putterman told GigaOM."

The difference being that you have to install tor in every single device you are using, with this box you anonimize the whole traffic of your network, anyone using your WiFi is automatically routed through TOR.

But, how does it do that. The article and even the Safeplug website do not explain the mechanism it uses to redirect your traffic to Tor. There aren't even any pictures of the back off the device that I can find.

Does it sit between your gateway and your router, and transparently redirect all packets to the tor network?

Do you just plug it into a router port and point your devices at it as a proxy?

Where is the source code? If we're going to be paranoid enough to use Tor for everything, shouldn't we demand to audit the code for security holes and possible backdoors?

It just seems like a product without a niche. Most users have no desire to use Tor, and those that do are typically savvy enough to set it up themselves.

Because the information provided isn't sufficient to understand what the box actually does. Does it act as a DHCP provider? How would my devices know to use it? Since it sits inside the network, how would devices which want to use it know its there? Do I have to update proxy settings on browsers?

Or automatically routed through any proxy the supplier chooses right? I mean how would you know if this doesn't just send all traffic to a pseudo TOR network setup by the NSA which captures everything you do?

I mean how would you know if this doesn't just send all traffic to a pseudo TOR network setup by the NSA which captures everything you do?

AKA half of Tor, I'd imagine. The point of Tor has never been to evade detection by the NSA. It's to anonymize your internet traffic to prevent the destination service operator from knowing who/where you are. It's essentially a chain of "legitimate," marginally highly-available TCP proxies that anyone can use without having to create or rent a botnet. Hidden services are a nice side effect, or at least were until Silk Road's compromise spooked everyone.

That said, your point stands: there's not enough information about how this magic box works.

One of the problems with that is that sometimes your real IP can leak out. For example, if you visit a page that installs the FBI's CIPAV malware, it will bypass Tor and report the real IP. If all traffic is routed through Tor by another device, this won't work.

Freedom Hosting's compromise was used to host an exploit for Firefox. The shellcode used Windows calls, but it was Firefox that was executing them, meaning it had all the rights that Firefox itself had, meaning it would probably have worked fine on any other OS with a little tweaking. But alas.

You can use Whonix in virtualbox. It basically replicates this setup, where you have a gateway VM and a workstation VM. The workstation can only access the Internet through the gateway. So if the workstation is compromised it still can't leak your IP.

Another case of the perfect being the enemy of the good. Technology does not have have to be perfect for it to be useful, furthermore there is always a cost/benefit tradeoff. Even locks that are easy to pick and windows easily broken are useful. I know that most of you have a condescending attitude towards users who are unconcerned about internet privacy. It may well their cost benefit tradeoff is far more reasonable than yours.

Unless you have a firewall to block normal internet traffic, and only allow tor traffic to go through.
In that case, even if your box gets compromized, there is no way of launching a side-channel attack.

One of the problems with that is that sometimes your real IP can leak out. For example, if you visit a page that installs the FBI's CIPAV malware, it will bypass Tor and report the real IP. If all traffic is routed through Tor by another device, this won't work.

There's a much easier way to to leak your IP over Tor -- use UDP. Or anything other than TCP, for that matter.

Clearly the benefit of a plug like this isn't at home. Bring down the price and size a notch and it will be ideal to hide at libraries, schools and other places that can't be traced back to you.Suddenly there is a whole bunch of tor nodes in your town that you can connect to, all of them used for completely legal stuff.

Yeah but, when your non-technical friend asks you about using Tor, do you want to point them to Raspberry Pi and get a dirty look, point them to the browser plugin and forever be saddled with support questions, or point them to the $50 "just plug it in and forget about it" hardware and earn their gratefulness?

One difference would be that this works for every piece of software on every computer that you connect to the network after the box - not just one browser.

This can be good or bad. You may be doing something very secret on your secure, anonymous computer. Then an insecure app on your iPhone opens an unencrypted connection to some server and tells the tor exit node who you are.

No, in his scenario, the tor exit node is run by a government that is watching all the traffic come out. Then they see your iPhone connection come out with your name, phone number, GPS location, etc. and can match that to all the other streams of data coming through the same circuit.

The meanings of words can change over time, and dictionary definitions are often behind the curve. Merriam-Webster's online dictionary gives as its third definition of democratic "relating to, appealing to, or available to the broad masses of the people". And for democratize they give the example sentence, "The magazine's goal is to democratize art".

If you'd like to know more about how words change over time, you should ask about the process in the discussion forum at Wordorigins.com [slashdot.org].

You did not acknowledge it, but hopefully you noticed that I didn't say "the new use rife in modern trashy jargon is wrong" and explicitly described it as "ambiguous", as the word is in a state of evolution.As long as there's putting power in the masses' hands, I have no objection to the term; for example, guiding the editorial policy of a periodical. However, a statement such as "twitter is democratizing the internet" I would consider to be a serious dilution of the earlier meaning of the term.

(shrug) Well, that's how it goes with words. What you like or what I like is irrelevant. I went to the OED, the de facto arbiter of English word definitions, and they have for democratize "make (something) accessible to everyone", with the following example sentence, "mass production has not democratized fashion." This is using the word in the same way that the OP used the word. I think if it's in the OED we can be confident that the word is not "in a state of evolution", but is acceptable for use in th

The OED lost the plot about a decade ago. By the time they're including things that have not proven to have any momentum in the language, and which then fall completely out of use, then following up with a new set of updates with even less traction, you know that they've completely forgotten what their mandate is.

While I wish I agreed with it, I completely disagree with your final sentence.

I'm sorry you disagree fatphil. Personally, I am not prepared to challenge the OED or MW in their assessments, but perhaps you are. People are using the word "democratize" in this fashion, like it or not. I know, I know. These things can be maddening. For instance, I do not like it when people use "literally" as an intensifier. It gets under my skin. Yet, that is what they are doing. I wish you luck in tilting at this particular windmill.

Aside - you'll be pleased to know that as of just 2 days ago I decided thenceforth to use "literarily" to mean "expressed as one would find in literature, namely exagerated or fictionalised". To contrast against "literally", clearly;-)

Oh, wait, it doesn't say anything. No description of the software, no developer access, "activation"? WTF is that? This is just another spy box, folks, just like your cellphone and your self-encrypting storage unit.

The number of exit nodes really depends on the country some have plenty others not so much.
I use SelekTOR myself which can be found here http://www.dazzleships.net/ [dazzleships.net] which lets you choose your exit node and also uses URL pattern matching which allows you to bypass a lot of geographic web blocks and watch UK tv for free.

Everything that is available via the BBC iPlayer website is available using SelekTOR and the dowloadable media patterns, also gives access to ITV and Channel 4 catchup and unblocks various torrents sites that have been blocked in the UK.
You can also create your own URL patterns.

Last I tried it, it necessarily slowed my Net connection down to essentially unusable because of an obvious lack of "exit nodes". Besides, all it does is add some very, very simple obfuscation to what you may be doing on the Net. It doesn't in any way provide any meaningful protection. The nature of TCP/IP precludes true anonymity. People pursuing anonymity through TCP/IP are the same kinds of people looking for perpetual motion machines.

Tor is not a magic bullet. Anything you send over Tor can be intercepted by an exit node. If you send any identifying information over Tor, all the onion routing in the world won't help you. You can easily do this accidentally, all it takes is for you to visit a page with a google or facebook script on it. You can't just plug into Tor and expect it to take care of everything for you.

The only way to use Tor securely is to partition your Tor activities from everything else you do. This is most easily accomplished with a separate computer, or a VM used only for anonymous activities. Remember, it only takes one slip up and you are identifiable. That's how they got Ulbricht, and they can get you too.

A box that you plug into and forget about is going to provide nothing but a false sense of security. Bad idea.

Exactly what I was going to post. If you don't take care of how you're using Tor, it will probably do more to flag you as "interesting" for the authorities to investigate further than protect your anonymity.

The kind of people and activities that need TOR to provide extreme anonymity need significantly more than just TOR alone to do it effectively. This seems like it could lull people into assuming otherwise.

What am I doing that's so important to keep secret? I'm minding my own business, that's what. You should do it too.

The reason we should all be afraid of the authorities spying on us is because more often than not, they are the POS humans that are the greatest threat. Remember COINTELPRO? Remember the FBI infiltrating mosques? Remember the IRS harassing political groups? Remember people like Thomas Drake being prosecuted for blowing the whistle on massive amounts of public corruption and fraud?

In an authoritarian regime, anything you do that stands out will get you unwanted attention. If you don't believe we're authortarian today, there's no guarantee we won't be in the future. If we can't protect our privacy today, how will we protect it then? If you want to live a free life, you need privacy.

As importantly, if you only encrypt things that you want keep secret, then you might as well not keep them secret at all. Not only are you waving a flag and essentially waving a red flag attracting Their* attention that you are now doing something covert ("I am done surfing Amazon.com and now intending to visit a forbidden website!"), it also makes it easier for Them to correlate your obfuscated traffic with traffic with the traffic that hits a forbidden site ("Hmmm, Bob went on Tor at 08:24:42.342 and at 08:24:42.359 traffic from a TOR exit node hit TheNSASucks.Com...").

On the other hand, if you disguise all your activity online, it makes it much harder for Them to do this sort of pattern matching.

So if you are going to use TOR - or use other similar privacy-protecting technologies or techniques - it is best used ALL the time and not just when you are doing something that specifically you don't want the bad guys to know about.

And as the previous poster indicated, just because what you are doing now isn't considered wrong doesn't mean it won't be considered immoral or illegal in the future, or used out of context by others to your disadvantage. As organizations become larger and more bureaucratic, they become more detached from the harm - intentional or otherwise - they can inflict on individuals. And it is not only governments who can cause this harm; corporations gather as much information about us and - as has been frequently been shown over the past few years - are far more careless about how they secure that information. As the old proverb goes, 'an ounce of prevention is worth a pound of cure'; I'd rather try to keep as much of my life out of anyone else's hands rather than try to clean up the mess after that same information is being used against me.

* They, Their and Them are generic placeholders for whichever bad guys you think are watching you, be it the NSA, KGB, KKK or Santa Claus.

As importantly, if you only encrypt things that you want keep secret, then you might as well not keep them secret at all. Not only are you waving a flag and essentially waving a red flag attracting Their* attention that you are now doing something covert ("I am done surfing Amazon.com and now intending to visit a forbidden website!"), it also makes it easier for Them to correlate your obfuscated traffic with traffic with the traffic that hits a forbidden site ("Hmmm, Bob went on Tor at 08:24:42.342 and at 0

It might also behoove us to remember that much of this spying is done by *third-party contractors*. This means that it's not only the government with access to this information, hired hands as well. God only knows where the information might end up.

Of course it is. Anonymity is compromised by the data you send through it or by correlating Tor traffic with clear traffic. Both of things can be avoided and are not a flaw in the system itself but rather user error.